Circuit and method for protecting electronic devices

ABSTRACT

The access time for the use of an electronic device, for example a chip, is prolonged after each unauthorized access attempt. The access time is determined by the time for the matching of the turn-on voltages of two floating gate cells. Before an access attempt, the turn-on voltage of one cell is set to a predefined initial value and the turn-on voltage of the other cell is set to a value which is higher in comparison and which is increased after each unauthorized access.

CROSS-REFERENCE TO RELATED APPLICATION

[0001] This application is a continuation of copending Internationalapplication Ser. No. PCT/DE00/03004, filed Sep. 1, 2000, whichdesignated the United States.

BACKGROUND OF THE INVENTION

[0002] 1. Field of the Invention

[0003] The present invention relates to an electronic circuit and amethod for protecting electronic devices, in particular for protectingthe enabling of chip functions.

[0004] Certain forms of electronic circuits, for example chip cards,require a high degree of secrecy of the information or stored datacontained in the circuit (for example keys in encryption technology).This information which relates to safety must be protected both againstanalyses by third parties and against manipulation. It is necessary inparticular to avoid unauthorized persons acquiring access to theinformation by repeating unauthorized access attempts to the respectiveelectronic device with such frequency that analysis of thesecurity-related information or access is made possible. This may be thecase, for example, if a PIN is discovered through repeated trials. Achip or chip card is therefore protected in such a way that after acertain number of unauthorized access attempts any further accessattempt, and therefore as a rule even an authorized access, isprohibited. The security measures are then in certain circumstances toorigid because, for example, even the person with access authorization isno longer allowed access after, for example, only two inadvertent failedattempts. It is also possible for such an event to occur in the case ofa defect in the terminal, which leads to the access authorization notbeing correctly detected by the terminal.

[0005] 2. Summary of the Invention

[0006] It is accordingly an object of the invention to provide a circuitand a method for securing electronic devices, which overcome theabove-mentioned disadvantages of the heretofore-known devices andmethods of this general type and which provide a novel technicalteaching for protecting the enabling of the function of an electronicdevice which provides sufficient protection against misuse and at thesame time prevents a situation in which use authorization is prematurelydenied owing to operator control errors or malfunctions.

[0007] With the foregoing and other objects in view there is provided,in accordance with the invention, an electronic circuit for protectingelectronic devices, comprising:

[0008] a first component and a second component each having anelectrical variable of the same type;

[0009] a third component for comparing values of the electrical variableof the first component and of the second component with one another;

[0010] a setting device for setting a value of the electrical variableof the first component and of the second component;

[0011] a matching device for matching the value of the electricalvariable of the first component to the value of the electrical variableof the second component, starting from a basic value, and during a givenperiod of time;

[0012] a checking device for checking whether an authorized use of theelectronic device is properly initiated, executed, and terminated, and,in case of unauthorized or improper use, the checking device bringingabout a change in the value of the electrical variable of the secondcomponent or a change in the matching device such that the period oftime necessary to match the value of the electrical variable of thefirst component to the value of the electrical variable of the secondcomponent by the matching device is prolonged.

[0013] With the above and other objects in view there is also provided,in accordance with the invention, a method of protecting electronicdevices, which comprises:

[0014] providing an electronic circuit with first and second componentseach having an electrical variable of the same type, and a device forsetting a value of the electrical variable in each of the first andsecond components;

[0015] ensuring that a use of the electronic device lasts at least aslong as is required for an electronic process that takes a specific timeto match a predefined basic value of the electrical variable of thefirst component to a respective value of the electrical variable of thesecond component functioning as a reference value; and

[0016] as a result of an unauthorized access attempt or as a result ofan improper use, prolonging the specific time taken by the electronicprocess by one of changing the reference value and changing a speed ofthe matching operation.

[0017] In other words, the circuit according to the invention and theassociated method according to the invention increase the access time,i.e. the time between the start of an access attempt and the enabling orexecution of a function of the electronic device, for example of a chip,in the case of unauthorized access operations. As a result, a DP(differential power) analysis is effectively prevented because the timerequired for it is increased to such an extent that it is virtuallyimpossible to carry out. When the means provided for an authorizedaccess are used in accordance with the regulations, the number and thefrequency of the access operations to the electronic device are notrestricted. At the same time, the method or the use of the circuit ishighly tolerant to access attempts which fail owing to inadvertentoperator errors or equipment faults.

[0018] The circuit according to the invention comprises two componentswhich are characterized by a common electrical variable, for example avoltage or a charge. In one of the components, this electrical variablecan be approximated to a reference value within the course of a specifictime interval, starting from a value which is different from thereference value, referred to below as the basic value. In the othercomponent, the electrical variable can preferably be set, or programmed,to different values so that in each case there is thus a reference valuewhich can be changed. There is a third component which is provided forcomparing the values of the electrical variable of the twoabove-mentioned components.

[0019] The components can be formed, for example, by two floating gatecells or by two capacitors or the like if the third component is acomparator which is provided for the comparison of electrical voltages.In one preferred embodiment with floating gate cells, the turn-onvoltage is selected as an electrical variable. The turn-on voltage ofthe first floating gate cell is chronologically changed and compared, bymeans of a comparator, with the turn-on voltage of the second floatinggate cell which forms the reference value. If an access attempt is madeto use the electronic device, for example when a chip card is introducedinto a card reader and a PIN is input, the first floating gate cell ischarged, starting from a value which is different from the referencevalue, the value being the basic value, until the comparator detectscorrespondence between the turn-on voltages of the cells.

[0020] After an unauthorized access attempt is detected, theabove-defined access time is increased by changing the reference valueor by decreasing the speed with which the values are approximated to oneanother. Unauthorized access attempts thus prolong the time to be waiteduntil, in the case of a subsequent access, the function is enabled or,for example, in the case of a chip card, a cryptoalgorithm for checkinga key finishes. This makes a DP analysis considerably more difficultbecause, even after a small number of unauthorized access attempts, thetime up to a possible use of the function has drastically increased. Theaccess time can be prolonged after any unauthorized access attempt oronly if additionally determined predefined conditions are fulfilled.

[0021] Several variations of the novel method are possible. Thefollowing provides an overview over four sequences which encompass theinvention. The method variations comprise:

[0022] in a first step, checking whether the value of the electricalvariable of the first component corresponds to a predefined basic value;

[0023] in a second step, if the value of the electrical variable of thefirst component corresponds to the predefined basic value, proceeding tothe following third step and, if the value of the electrical variable ofthe first component does not correspond to the predefined basic value,setting the value of the electrical variable of the first component tothe basic value and setting the value of the electrical variable of thesecond component to a new reference value, so that the specific timetaken by the electronic process is prolonged;

[0024] in a third step, executing the electronic process until thevalues of the electrical variable of the two components match oneanother;

[0025] in a fourth step, checking whether authorization exists to usethe electronic device;

[0026] in a fifth step, if authorization exists, rendering possible theuse of the electronic device and, if authorization does not exist,setting the value of the electrical variable of the second component toa new reference value, so that the time taken by the electronic processis prolonged; and

[0027] in a sixth step, setting the value of the electrical variable ofthe first component to the basic value.

[0028] Alternatively, the novel method is broken down as follows:

[0029] in a first step, checking whether the value of the electricalvariable of the first component corresponds to a predefined basic value;

[0030] in a second step, if the value of the electrical variable of thefirst component corresponds to the predefined basic value, proceeding tothe following third step and, if the value of the electrical variable ofthe first component does not correspond to the predefined basic value,setting the value of the electrical variable of the first component tothe basic value and setting the value of the electrical variable of thesecond component to a new reference value, so that the specific timetaken by the electronic process is prolonged, and executing theelectronic process until the values of the electrical variable of thetwo components match one another;

[0031] in a third step, checking whether authorization exists to use theelectronic device;

[0032] in a fourth step, if authorization exists, executing theelectronic process until the values of the electrical variable of thetwo components correspond and rendering possible the use of theelectronic device and, if authorization does not exist, setting thevalue of the electrical variable of the second component to a newreference value, so that the time taken by the electronic process isprolonged; and

[0033] in a fifth step, setting the value of the electrical variable ofthe first component to the basic value.

[0034] In a further alternative embodiment of the novel method, thesequence comprises:

[0035] in a first step, checking whether the value of the electricalvariable of the first component is equal to the value of the electricalvariable of the second component;

[0036] in a second step, if the values of the electrical variables areequal, proceeding with the system to the following third step and, ifthe values are not equal, setting the value of the electrical variableof the second component to a new reference value, so that the time takenby the electronic process is prolonged;

[0037] in a third step, setting the value of the electrical variable ofthe first component to a predefined basic value different from thereference value;

[0038] in a fourth step, executing the electronic process until thevalues of the electrical variable of the two components correspond;

[0039] in a fifth step, checking whether authorization exists to use theelectronic device; and

[0040] in a sixth step, if authorization exists, rendering possible theuse of the electronic device and, if authorization does not exist,setting the value of the electrical variable of the second component toa new reference value, so that the time taken by the electronic processis prolonged.

[0041] In accordance with a concomitant feature of the invention, themethod comprises:

[0042] in a first step, checking whether the value of the electricalvariable of the first component is equal to the value of the electricalvariable of the second component;

[0043] in a second step, if the values of the electrical variables areequal, proceeding with the system to the following third step and, ifthe values are not equal, setting the value of the electrical variableof the second component to a new reference value, so that the time takenby the electronic process is prolonged, and executing the electronicprocess until the values of the electrical variable of the twocomponents correspond;

[0044] in a third step, setting the value of the electrical variable ofthe first component to a predefined basic value different from thereference value;

[0045] in a fourth step, checking whether authorization exists to usethe electronic device;

[0046] in a fifth step, if authorization exists, executing theelectronic process until the values of the electrical variable of thetwo components correspond and rendering possible the use of theelectronic device and, if authorization does not exist, aborting theprocess.

[0047] Other features which are considered as characteristic for theinvention are set forth in the appended claims.

[0048] Although the invention is illustrated and described herein asembodied in a circuit and method for protecting electronic devices, itis nevertheless not intended to be limited to the details shown, sincevarious modifications and structural changes may be made therein withoutdeparting from the spirit of the invention and within the scope andrange of equivalents of the claims.

[0049] The construction and method of operation of the invention,however, together with additional objects and advantages thereof will bebest understood from the following description of specific embodimentswhen read in connection with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0050]FIG. 1 is a flowchart illustrating a method according to theinvention;

[0051]FIG. 2 is a flowchart illustrating a variation of the novelmethod; and

[0052]FIG. 3 is a flowchart illustrating a further variation.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0053] A more precise description of exemplary embodiments of theinvention will follow with reference to the program flowchartsrepresented in the three figures of the drawing. For the sake of moresimple designations, it will be assumed in each case that the electroniccomponents of the circuit are two floating gate cells and a comparatorwhich, in this example, compares the turn-on voltages of the cells withone another as the electrical variable.

[0054] Referring now to the figures of the drawing in detail and first,particularly, to the flowchart of FIG. 1 thereof, there is shown a firstexemplary embodiment of the invention. The value of an electricalvariable of the first component (one of the floating gate cells,referred to below as cell A) is set to a specific basic value (aspecific turn-on voltage U_(A0)) before it is first detected whetherthere is an authorization to use the electronic device, that is to sayfor example before the first insertion of a chip card into the chip cardreader, and the value of the electrical variable of the second component(the other floating gate cell, referred to below as cell B) is set to areference value which is different therefrom in a predefined way(different turn-on voltage U_(B0), preferably higher than U_(A0)). Thecomponents are thus in their basic states. In the case of a chip card,an access attempt is typically initialized by introducing the card intoa card reader (INS-START) and inputting a PIN or comparable data. It isthen firstly checked whether the first component (cell A) is in thebasic state (with the turn-on voltage at the basic value U_(A0)). Ifthis is the case (A=_?✓), the checking of the access authorization isstarted by firstly slowly adjusting the value of the electrical variableof the first component (turn-on voltage U_(A0) of the cell A) to thereference value (turn-on voltage U_(B0) of the cell B), (A_

^(—)B by charging cell A, for example by means of a sequence of shortpulses or by means of a programming voltage which is reduced incomparison to normal operation). The functions of the electronic devicewhich are to be used are enabled, in the case of an authorized access,after checking of the access authorization (ACC ?✓) only if bothcomponents have the same value of the electrical variable (referencevalue, specifically the same turn-on voltage), or the absolute value ofthe difference between the values is less than a predefined low value,which is determined by the comparator in the example.

[0055] After the user has used (USE) the functions of the electronicdevices, that is to say for example at the end of an executed chip(card) function, the first component (cell A) is returned (A↓_) to thebasic state (turn-on voltage at the basic value U_(A0)). The circuit isthus initialized (A=_) for the next access attempt, for example to thefunctions of a chip. The use is terminated (STOP-EJ) in a conventionalway (with the ejection of the card in the case of the chip card). If useis prematurely aborted, the first component (cell A) still has a valueof the electrical variable which is different from the basic value (A≠_,turn-on voltage of cell A is different from U_(A0)) when the next accessattempt starts.

[0056] In the original state, for example when a chip protected with acircuit according to the invention is issued to the purchaser, the basicstates of the components are set in such a way that, when the value ofthe first component changes over time (charging of the first cell A),the reference value (the turn-on voltage of the cell B) is reached in avery short time so that the enabling of the functions of the electronicdevice (of the chip functions in this case) is not perceptibly delayed.

[0057] After an unauthorized access attempt (ACC ? not ✓), it isensured, by suitable means, known per se, of the electronic circuit,that an approximation of the values of the components (turn-on voltagesof the cells) takes longer than previously. This occurs preferably evenif an authorized access to the use is prematurely aborted. In the caseof an embodiment with floating-gate cells and a lower turn-on voltage ofthe cell A than the basic value, and with a higher turn-on voltage ofthe cell B than the reference value, the turn-on voltage of the secondcell B can be increased somewhat (B↑^(—), for example by means of abrief programming pulse) to a new, higher reference value so that ittakes longer until the first cell A is charged, starting from the basicstate, to such an extent that the turn-on voltages of both cellscorrespond. The consequence is that the access time is increased. If itis determined at the start of the access attempt that the cell A is notin the basic state (A=_? not ✓, for example abort of the last access),in this exemplary embodiment the turn-on voltage of cell A is set (A↓_)to the basic value U_(A0), and the turn-on voltage of cell B is changedto a value which differs more greatly from it than the new referencevalue (in the example increased further, B↑^(—)). The approximation ofthe turn-on voltages does not take place until now.

[0058] The conditions are preferably set in such a way that, up to anumber of failed access attempts (up to, for example, several hundreddepending on the application) which is permitted with respect tosecurity issues, the prolonged access time does not yet perceptiblyrestrict the benefit of the electronic device in the practicalapplication, for example of the chip. The circuit according to theinvention is preferably constructed in such a way that above apredefined number of unauthorized access attempts the time period forthe approximation of the turn-on voltages of the cells rises verygreatly so that it is virtually impossible still to carry out a DPanalysis.

[0059] The circuit is preferably conditioned in such a way that, to beon the safe side, the access time is prolonged even when an accessattempt is aborted. This is determined by the interrogation as towhether the first component (cell A) is in the basic state (A=_?). Ifthe access attempt is aborted after the approximation of the values ofthe electrical variable of the components (for example turn-on voltagesof the floating gate cells) has started, so that the first component(cell A) is not in the basic state, the value of the first component ispreferably reset to the basic value (the turn-on voltage of the cell Ato U_(A0)) at the start of the next access attempt, and the referencevalue (the turn-on voltage of the cell B) is changed as a precaution(increased in the present example) as if it had been determined at theprevious access attempt that there was no use authorization or accessauthorization. This ensures that the circuit according to the inventionis in a state of very short access times only if exclusively authorizedaccesses took place, and were satisfactorily terminated, before. If thevoltage level of a floating gate cell A is not sufficient to determinewhether the turn-on voltage of this cell has been reset to the basicvalue after an authorized and terminated access, an additional cell canbe used for this evaluation (for example a digital flag cell).

[0060] In order to adapt the dependence of the access time on the numberof previous non-authorized access attempts in an optimum way, the changein the reference value stored in one of the components, for example theprogramming of the cell B whose turn-on voltage is progressivelyincreased at unsuccessful or aborted access attempts, can be controlledas a function of the respective state of this component (for example bymeans of dynamic adaptation of the programming voltage or programmingperiod). If floating gate cells are used, it is possible, instead ofchanging the turn-on voltage of the cell B after each failed or abortedaccess attempt, to bring about the prolonged access time by increasinglydelaying the charging of the cell A for the approximation of the turn-onvoltages, e.g. by changing the basic value of the turn-on voltage of thecell A or by slowing down the charging process. However, in contrast tothe preferred exemplary embodiment described above, this requires afurther circuit component for registering the access attempts which havenot been satisfactorily terminated.

[0061] A further exemplary embodiment, in which the procedurecorresponding to the program flowchart in FIG. 2 is adopted, providesthat, after the initialization and an interrogation which preferablytakes place to determine whether the component to be approximated(floating gate cell A) is in the basic state (A=_?), an interrogation isfirst carried out to determine whether access authorization applies (ACC?). If this is the case (ACC ?✓), the values (basic value and referencevalue) of the electrical variable of the components are approximated;for example the turn-on voltage of the cell A is adjusted to the turn-onvoltage of the cell B (A_

^(—)B). During this process, the use of the function (USE) of theelectronic device (for example the chip functions of the chip card) canalready be enabled so that the user does not have to wait for the entireapproximation process. The access time increases perceptibly only in thecase of a repeatedly changed setting of the second component (cell B)owing to multiple faulty access attempts.

[0062] If it is determined at the start of the access attempt that thefirst component (cell A) is not in the basic state (A=? not ✓), a delayof the access time is then preferably also provided in this exemplaryembodiment. For this purpose, the first component is firstly adjusted tothe basic state (the turn-on voltage of cell A is set to the basic valueU_(A0)) and the reference value is changed (the turn-on voltage of cellB is changed, i.e. further increased in the example, A↓_B↑^(—)). Thechecking of the access authorization (ACC ?) does not take place until asubsequent approximation of the values of the electrical variable of thecomponents A_

^(—)B). In order to prevent the analysis of a cryptoalgorithm, theaccess time is preferably increased in the cases in which an accessattempt is aborted after the checking of the access authorization. Thiscan be carried out easily by ensuring that the value of the electricalvariable of the first component (cell A) is always different from thevalue in the basic state after the checking of the access authorization(ACC ?). When the values of the electrical variable of the components(A_

^(—)B) have already been approximated, this is already so in any case.If the checking as to whether the component (cell A) to be approximatedis in the basic state (A=_?) supplies a positive result, the value ofthe electrical variable of the first component can be set to a value(A≠_), for example, which is different from the basic state but ensuresan adequate time period for the approximation to the value of theelectrical variable of the second component (for example is somewhatlower or only a little higher than the value in the basic state).

[0063] If an absence of access authorization is determined (ACC ? not✓), the reference value is also changed (the turn-on voltage of cell Bis changed, B↑^(—)), so that the access time is prolonged at subsequentaccess attempts. In this exemplary embodiment also, the first componentis reset to the basic state (the turn-on voltage of the cell A toU_(A0), A↓_) after a terminated use (USE). After a premature abort ofthe access during the approximation process, this component is no longerin the basic state (A≠_). When there is a renewed access attempt, thistriggers the described change in the state of the second component (cellB, A↓_B↑^(—)).

[0064] This exemplary embodiment has the advantage that the access timeis not delayed by the process of approximation of the basic value andreference value of the two components if the use of the electronicdevice (chip function) is already enabled during this process. When theuse of the circuit is exclusively in accordance with the regulations, aprolonged access time is consequently only apparent after a multiplicityof faulty access operations.

[0065] A further exemplary embodiment, in which the procedurecorresponding to the program flowchart in FIG. 3 is adopted, providesthat, when there is satisfactory use of the circuit at the start, theelectrical variable to be compared at the two components has the samevalue (A=B), i.e. in this exemplary embodiment both values are equal tothe reference value in the basic state of the components. If this is notthe case (A=B ? not ✓), the value of the second component (referencevalue) is changed in such a way that it takes a longer time interval forthe reference value to be reached starting from the basic value of thefirst component than before (B↑^(—)) and a time delay is subsequentlybrought about, with approximation of the values of the electricalvariable of the components (A_

^(—)B). Then, the basic value is set (A↓_) in each case at the firstcomponent. If appropriate, data (PIN or the like) which is necessary forthe checking of the access authorization is entered after this firstinterrogation. However, as in the previously described exemplaryembodiments, this can also take place at the start (for exampleimmediately after the insertion of a chip card INS→START).

[0066] Before or after the checking of the access authorization (ACC ?),the values of the electrical variable are approximated to one another bychanging the basic value during a specific time interval and graduallyapproximating it (A_

^(—)B) to the reference value. Use can already be enabled (USE) whilethis process is taking place if the access authorization has alreadybeen determined. After the values (A=B, if appropriate withinunavoidable tolerances) have been approximated, both components are inthe basic state which is characteristic of this exemplary embodiment andwhich permits renewed access without prolongation of the access time. Ifthe access is denied (ACC ? not ✓) or if the access is prematurelyaborted (no complete approximation), the values of the electricalvariable at the two components are different from one another (A≠B), sothat at the start of the next access attempt a change in the value(reference value) of the second component (B↑^(—)) is automaticallybrought about and a time delay is caused by the described process ofapproximation (A_

^(—)B).

[0067] In order to be able to exclude manipulation by means of UVradiation in the exemplary embodiments with floating gate cells withdifferent basic states (basic value not equal to the reference value),it is possible to provide a further cell C in the circuit in addition tothe cell B whose turn-on voltage is successively increased afterunsuccessful access attempts, said cell C being respectively placed inthe opposite state to that of cell B. In some embodiments, this can becarried out by supplying the further cell C with pulses of equal heightand duration as those supplied to the cell B, but with oppositepolarity. The two cells B and C are preferably arranged adjacent to oneanother and provided with a difference in their turn-on voltages beforethe circuit is first used. If the two cells later exhibit the sameturn-on voltage in any operating state, this can be taken as anindication that an attempt has been made to manipulate the circuit withUV radiation. Suitable countermeasures can then be taken.

[0068] By means of a suitable embodiment of the source/drain terminalsof the cell B whose turn-on voltage is successively changed afterunsuccessful access attempts, it is possible to prevent this turn-onvoltage from being electrically reset to its initial value. It is thuspossible to prevent the turn-on voltages being electronicallyapproximated, and the security function of the circuit thus beingbypassed.

[0069] The access authorization can, depending on the prevailingsecurity requirements, be already checked during the process ofapproximation of the values of the components (charging of the one cell)or be checked only after approximation (of the turn-on voltages) hasoccurred completely. If the result of the interrogation (ACC ?) of theaccess authorization is that there is authorization for the electronicdevice to be used, this use is enabled and the access can take place.After successful termination of the access, the circuit brings about areset with which at least the component of the circuit, whose value ischanged in the approximation process (cell A), is reset to thepredefined basic state. If the result of the interrogation of the accessauthorization is, on the other hand, that there is no authorized accessattempt, either because there is no authorization or because there is adefect in the electronic device (terminal) which checks theauthorization, there is a change in the access time in that thedifference between the basic value of the first component and thereference value of the second component (for example the differencebetween the absolute values of the turn-on voltages of the cells) isincreased. When there is a renewed access attempt, the access time isdetermined with the approximation of these values which are now adjustedto a larger difference. Depending on whether the interrogation resultsin there being authorization or no authorization, the access to the useof the electronic device is enabled or a change in the access time isbrought about again.

[0070] With the circuit according to the invention it is necessary onlyfor the first component to be reset to the basic state after each accesshas been satisfactorily terminated. However, the result of this is that,during the entire period of use of the circuit (for example service lifeof the chip card), any access which is not carried out in accordancewith the regulations brings about a prolongation of the access time sothat the use of the circuit is, under certain circumstances, severelyadversely affected after some time. When there are low securityrequirements it is therefore possible to provide for both components(both cell A and cell B) to be reset to their respective basic stateswhen there is satisfactory termination (STOP) of any authorized access.Alternatively it is possible to provide that such a complete reset iscarried out only at the express command (corresponding inputting ofdata) of the user during an authorized access. The user of the circuitcould in this case reset the access time to a low initial value after anumber of faultily executed access operations.

[0071] Owing to the short access times which at most increaseinsignificantly when there are access attempts by authorized persons,this method is suitable for all applications, even for chips or chipcards which are used in a contactless fashion. Because the number ofaccess attempts is not restricted in a specific time period when thereis use according to the regulations, the method is suitable for allapplications with a high access frequency. Even when there is a fault ina terminal and there are resulting rejected access attempts, theoperational capability of a chip or of another protected electronicdevice is basically retained. This is an advantage over conventionallocking out of a chip by means of a failed attempt counter.

We claim:
 1. An electronic circuit for protecting electronic devices,comprising: a first component and a second component each having anelectrical variable of the same type; a third component for comparingvalues of the electrical variable of the first component and of thesecond component with one another; a setting device for setting a valueof the electrical variable of said first component and of said secondcomponent; a matching device for matching the value of the electricalvariable of the first component to the value of the electrical variableof the second component, starting from a basic value, and during a givenperiod of time; a checking device for checking whether an authorized useof the electronic device is properly initiated, executed, andterminated, and, in case of unauthorized or improper use, said checkingdevice bringing about a change in the value of the electrical variableof the second component or a change in the matching device such that theperiod of time necessary to match the value of the electrical variableof the first component to the value of the electrical variable of thesecond component by the matching device is prolonged.
 2. The circuitaccording to claim 1, wherein said checking device checks whether thevalue of the electrical variable of the first component is equal to avalue which the electrical variable of the first component has after ause of the electronic device that is properly terminated.
 3. The circuitaccording to claim 1, wherein said first component is a first floatinggate cell and said second component is a second floating gate cell. 4.The circuit according to claim 3, wherein the electrical variable ofsaid first and second components is a turn-on voltage, and wherein, incase of unauthorized or improper use, a value of the turn-on voltage ofsaid second floating gate cell is changed.
 5. A method of protectingelectronic devices, which comprises: providing an electronic circuitwith first and second components each having an electrical variable ofthe same type, and a device for setting a value of the electricalvariable in each of the first and second components; ensuring that a useof the electronic device lasts at least as long as is required for anelectronic process that takes a specific time to match a predefinedbasic value of the electrical variable of the first component to arespective value of the electrical variable of the second componentfunctioning as a reference value; and as a result of an unauthorizedaccess or as a result of an improper use, prolonging the specific timetaken by the electronic process by one of changing the reference valueand changing a speed of the matching operation.
 6. The method accordingto claim 5, wherein the components of the circuit are two floating gatecells with adjustable turn-on voltages, and the electronic process is adelayed charging of one of the floating gate cells.
 7. The methodaccording to claim 5, which comprises: in a first step, checking whetherthe value of the electrical variable of the first component correspondsto a predefined basic value; in a second step, if the value of theelectrical variable of the first component corresponds to the predefinedbasic value, proceeding to the following third step and, if the value ofthe electrical variable of the first component does not correspond tothe predefined basic value, setting the value of the electrical variableof the first component to the basic value and setting the value of theelectrical variable of the second component to a new reference value, sothat the specific time taken by the electronic process is prolonged; ina third step, executing the electronic process until the values of theelectrical variable of the two components match one another; in a fourthstep, checking whether authorization exists to use the electronicdevice; in a fifth step, if authorization exists, rendering possible theuse of the electronic device and, if authorization does not exist,setting the value of the electrical variable of the second component toa new reference value, so that the time taken by the electronic processis prolonged; and in a sixth step, setting the value of the electricalvariable of the first component to the basic value.
 8. The methodaccording to claim 5, which comprises: in a first step, checking whetherthe value of the electrical variable of the first component correspondsto a predefined basic value; in a second step, if the value of theelectrical variable of the first component corresponds to the predefinedbasic value, proceeding to the following third step and, if the value ofthe electrical variable of the first component does not correspond tothe predefined basic value, setting the value of the electrical variableof the first component to the basic value and setting the value of theelectrical variable of the second component to a new reference value, sothat the specific time taken by the electronic process is prolonged, andexecuting the electronic process until the values of the electricalvariable of the two components match one another; in a third step,checking whether authorization exists to use the electronic device; in afourth step, if authorization exists, executing the electronic processuntil the values of the electrical variable of the two componentscorrespond and rendering possible the use of the electronic device and,if authorization does not exist, setting the value of the electricalvariable of the second component to a new reference value, so that thetime taken by the electronic process is prolonged; and in a fifth step,setting the value of the electrical variable of the first component tothe basic value.
 9. The method according to claim 5, which comprises: ina first step, checking whether the value of the electrical variable ofthe first component is equal to the value of the electrical variable ofthe second component; in a second step, if the values of the electricalvariables are equal, proceeding with the system to the following thirdstep and, if the values are not equal, setting the value of theelectrical variable of the second component to a new reference value, sothat the time taken by the electronic process is prolonged; in a thirdstep, setting the value of the electrical variable of the firstcomponent to a predefined basic value different from the referencevalue; in a fourth step, executing the electronic process until thevalues of the electrical variable of the two components correspond; in afifth step, checking whether authorization exists to use the electronicdevice; and in a sixth step, if authorization exists, rendering possiblethe use of the electronic device and, if authorization does not exist,setting the value of the electrical variable of the second component toa new reference value, so that the time taken by the electronic processis prolonged.
 10. The method according to claim 5, which comprises: in afirst step, checking whether the value of the electrical variable of thefirst component is equal to the value of the electrical variable of thesecond component; in a second step, if the values of the electricalvariables are equal, proceeding with the system to the following thirdstep and, if the values are not equal, setting the value of theelectrical variable of the second component to a new reference value, sothat the time taken by the electronic process is prolonged, andexecuting the electronic process until the values of the electricalvariable of the two components correspond; in a third step, setting thevalue of the electrical variable of the first component to a predefinedbasic value different from the reference value; in a fourth step,checking whether authorization exists to use the electronic device; in afifth step, if authorization exists, executing the electronic processuntil the values of the electrical variable of the two componentscorrespond and rendering possible the use of the electronic device and,if authorization does not exist, aborting the process.